From 74d00a8c3849c1340efd713eb94b786e304c201f Mon Sep 17 00:00:00 2001 From: John Crispin Date: Sun, 25 Dec 2016 20:11:34 +0100 Subject: kernel: split patches folder up into backport, pending and hack folders * properly format/comment all patches * merge debloat patches * merge Kconfig patches * merge swconfig patches * merge hotplug patches * drop 200-fix_localversion.patch - upstream * drop 222-arm_zimage_none.patch - unused * drop 252-mv_cesa_depends.patch - no longer required * drop 410-mtd-move-forward-declaration-of-struct-mtd_info.patch - unused * drop 661-fq_codel_keep_dropped_stats.patch - outdated * drop 702-phy_add_aneg_done_function.patch - upstream * drop 840-rtc7301.patch - unused * drop 841-rtc_pt7c4338.patch - upstream * drop 921-use_preinit_as_init.patch - unused * drop spio-gpio-old and gpio-mmc - unused Signed-off-by: John Crispin --- ...core-usb_alloc_dev-fix-setting-of-portnum.patch | 108 +++++++++++++++++++++ 1 file changed, 108 insertions(+) create mode 100644 target/linux/generic/pending-4.4/082-0002-usb-core-usb_alloc_dev-fix-setting-of-portnum.patch (limited to 'target/linux/generic/pending-4.4/082-0002-usb-core-usb_alloc_dev-fix-setting-of-portnum.patch') diff --git a/target/linux/generic/pending-4.4/082-0002-usb-core-usb_alloc_dev-fix-setting-of-portnum.patch b/target/linux/generic/pending-4.4/082-0002-usb-core-usb_alloc_dev-fix-setting-of-portnum.patch new file mode 100644 index 0000000000..15cf4cae56 --- /dev/null +++ b/target/linux/generic/pending-4.4/082-0002-usb-core-usb_alloc_dev-fix-setting-of-portnum.patch @@ -0,0 +1,108 @@ +From 7222c832254a75dcd67d683df75753d4a4e125bb Mon Sep 17 00:00:00 2001 +From: Nicolai Stange +Date: Thu, 17 Mar 2016 23:53:02 +0100 +Subject: [PATCH] usb/core: usb_alloc_dev(): fix setting of ->portnum + +With commit 69bec7259853 ("USB: core: let USB device know device node"), +the port1 argument of usb_alloc_dev() gets overwritten as follows: + + ... usb_alloc_dev(..., unsigned port1) + { + ... + if (!parent->parent) { + port1 = usb_hcd_find_raw_port_number(..., port1); + } + ... + } + +Later on, this now overwritten port1 gets assigned to ->portnum: + + dev->portnum = port1; + +However, since xhci_find_raw_port_number() isn't idempotent, the +aforementioned commit causes a number of KASAN splats like the following: + + BUG: KASAN: slab-out-of-bounds in xhci_find_raw_port_number+0x98/0x170 + at addr ffff8801d9311670 + Read of size 8 by task kworker/2:1/87 + [...] + Workqueue: usb_hub_wq hub_event + 0000000000000188 000000005814b877 ffff8800cba17588 ffffffff8191447e + 0000000041b58ab3 ffffffff82a03209 ffffffff819143a2 ffffffff82a252f4 + ffff8801d93115e0 0000000000000188 ffff8801d9311628 ffff8800cba17588 + Call Trace: + [] dump_stack+0xdc/0x15e + [] ? _atomic_dec_and_lock+0xa2/0xa2 + [] ? print_section+0x61/0xb0 + [] print_trailer+0x179/0x2c0 + [] object_err+0x34/0x40 + [] kasan_report_error+0x2f8/0x8b0 + [] ? __slab_alloc+0x5e/0x90 + [] ? __lock_is_held+0x90/0x130 + [] kasan_report+0x71/0xa0 + [] ? kmem_cache_alloc_trace+0x212/0x560 + [] ? xhci_find_raw_port_number+0x98/0x170 + [] __asan_load8+0x64/0x70 + [] xhci_find_raw_port_number+0x98/0x170 + [] xhci_setup_addressable_virt_dev+0x235/0xa10 + [] xhci_setup_device+0x3c1/0x1430 + [] ? trace_hardirqs_on+0xd/0x10 + [] ? xhci_setup_device+0x1430/0x1430 + [] xhci_address_device+0x13/0x20 + [] hub_port_init+0x55a/0x1550 + [] hub_event+0xef5/0x24d0 + [] ? hub_port_debounce+0x2f0/0x2f0 + [] ? debug_object_deactivate+0x1be/0x270 + [] ? print_rt_rq+0x53/0x2d0 + [] ? trace_hardirqs_off+0xd/0x10 + [] ? _raw_spin_unlock_irqrestore+0x5b/0x60 + [] ? irq_domain_set_hwirq_and_chip+0x30/0xb0 + [] ? debug_lockdep_rcu_enabled+0x39/0x40 + [] ? __lock_is_held+0x90/0x130 + [] process_one_work+0x567/0xec0 + [...] + +Afterwards, xhci reports some functional errors: + + xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion + code 0x11. + xhci_hcd 0000:00:14.0: ERROR: unexpected setup address command completion + code 0x11. + usb 4-3: device not accepting address 2, error -22 + +Fix this by not overwriting the port1 argument in usb_alloc_dev(), but +storing the raw port number as required by OF in an additional variable, +raw_port. + +Fixes: 69bec7259853 ("USB: core: let USB device know device node") +Signed-off-by: Nicolai Stange +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/usb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -423,6 +423,7 @@ struct usb_device *usb_alloc_dev(struct + struct usb_device *dev; + struct usb_hcd *usb_hcd = bus_to_hcd(bus); + unsigned root_hub = 0; ++ unsigned raw_port = port1; + + dev = kzalloc(sizeof(*dev), GFP_KERNEL); + if (!dev) +@@ -497,11 +498,11 @@ struct usb_device *usb_alloc_dev(struct + + if (!parent->parent) { + /* device under root hub's port */ +- port1 = usb_hcd_find_raw_port_number(usb_hcd, ++ raw_port = usb_hcd_find_raw_port_number(usb_hcd, + port1); + } + dev->dev.of_node = usb_of_get_child_node(parent->dev.of_node, +- port1); ++ raw_port); + + /* hub driver sets up TT records */ + } -- cgit v1.2.3